November 04, 2021 | Bob Riley

Risky password behavior: How to prevent it

Other WE Blogs
Bob Riley, Senior Product Manager of Network and Security Service Portfolios

Bob Riley

Bob Riley is a Senior Product Manager in Windstream Enterprise’s network and security service portfolios. Within this role, Bob provides leadership and life cycle management for enterprise security and compliance solutions. He joined the organization in 2020 and has more than 20 years of product development, management and marketing experience in the Telecom industry.
Summary: Boundaries between work and personal life are collapsing and leading to risky security behaviors—such as sloppy password habits that are easily exploited by cybercriminals to breach a company’s defenses. Here’s advice on how to clean it up.

Can you guess what the most popular passwords were for 2021? They might look a bit familiar: 123456, qwerty and password.1 Yes, even as we approach 2022—where data breaches and cyberattacks are becoming more common, more dangerous and more expensive than ever—we are not practicing good password hygiene.

business woman staring seriously at laptop

What is bad password hygiene?

Password hygiene is the important practice of ensuring passwords are unique, difficult to guess and hard to crack. It’s the set of guidelines and principles that, when leveraged correctly, helps keep your passwords protected from cybercriminals.

Earlier this year, IBM conducted a global survey examining consumers’ digital behaviors during the pandemic, as well as their potential long-term impact on cybersecurity. The study found that individuals created 15 new accounts on average during the pandemic, with 82% reusing passwords across accounts.2 These findings show just how much convenience outweighs security and privacy.

While this study focused on account overload for consumers, it’s safe to argue that many individuals share passwords between work and personal life. And with more people working from their less secure home offices than traditional business locations, we can begin to understand why organizations and their employees are at more risk than ever before.

Changing your password isn’t enough

Passwords are meant to protect your valuable business information from hackers, but unfortunately, we can no longer rely on passwords alone. Cybercriminals are cracking passwords with simple yet sophisticated methods. You might recall when hackers took down the Colonial Pipeline Company earlier this year. An account within the company wasn’t using multifactor authentication (MFA), a basic cybersecurity tool that requires a user to provide two or more verification factors to gain access to a resource such as an application, online account or VPN. This allowed hackers to breach the network using just a compromised username and password.

The use of MFA may have averted the compromise of the Colonial systems and the need for the company to pay hackers $5 million to regain access, as well as hardship associated with widespread fuel shortages across the Southeast.

Government guidance for MFA

The National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) released a Cybersecurity Information Sheet full of recommendations, including the use of remote-access VPN products that support MFA.

MFA is an effective tool that offers a strong defense against hackers trying to steal your credentials. The methodology is based on one of three types of information:

  • Things you know, such as a password or personal identification number (PIN)
  • Things you have or possess, such as a token generator or smartphone
  • Things that make you unique, such as a biometric identifier like voice recognition or a fingerprint

Today, we’re seeing an increased use of MFA or 2FA (two-factor authentication) with the online services in our personal and professional lives. For instance, Ring, a home security and smart home company owned by Amazon, recently required the use of two-step verification, a version of MFA, to access their application. As another example, Windstream Enterprise uses 2FA technology to protect our SD-WAN Customer Portal.

Stay protected

Enforcing the use of an MFA like a thumbprint or physical hardware key means increased confidence that your organization will stay safe from cybercriminals. Keep your business, employees and customers safe by upping your security solutions to support the use of MFA technology, such as MNS from Windstream Enterprise. Our Professional Services team is available to assist your organization in the planning and deploying of MFA, reducing the complexity of integrating this technology into your cybersecurity defenses. 

References

  1. Meyer, Bernard. CyberNews. “Most Common Passwords: Latest 2021 Statistics.” October 15, 2021.
  2. IBM, “IBM Survey: Pandemic-Induced Digital Reliance Creates Lingering Security Side Effects.” July 15, 2021.

Key takeaway: Multifactor authentication is a great way to protect against poor password creation and maintenance.
Senior Product Manager

Bob Riley

Bob Riley is a Senior Product Manager in Windstream Enterprise’s network and security service portfolios. Within this role, Bob provides leadership and life cycle management for enterprise security and compliance solutions. He joined the organization in 2020 and has more than 20 years of product development, management and marketing experience in the Telecom industry.